Windows Partition Driver CVE-2026-97805

Exploitation targets the Windows Partition Management Driver and, per the vendor CVSS vector (PR:N/UI:N), requires no authentication and no user interaction against affected default installations; affected products are the supported Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650). The practical limiting factor is reachability of the vulnerable driver code path over the network plus the inherent difficulty of converting an out-of-bounds read into reliable remote code execution against Windows kernel mitigations (ASLR, kernel-mode protections); applying the Microsoft patch to the listed build thresholds eliminates exposure.

This is a high-priority vulnerability on paper: the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with HIGH impact across confidentiality, integrity, and availability, scoring 9.8 (Critical). A vendor patch exists (Microsoft, via MSRC), and the issue affects essentially the entire supported Windows and Windows Server line. However, several escalating signals are MISSING: there is no EPSS probability in the input, the CVE is NOT on CISA KEV, and no public POC is referenced, so exploitation is 'no public exploit identified at time of analysis.' There is also an internal tension to verify: the description characterizes the root cause as an out-of-bounds READ (typically an information-disclosure or crash primitive) yet claims it 'allows an unauthorized attacker to execute code over a network' with AC:L - OOB-read-to-RCE normally requires defeating memory protections (ASLR/kernel mitigations), which argues for higher real-world attack complexity than AC:L suggests; verify the exploitation mechanics with Microsoft. Net assessment: treat as a genuine patch-now item given the ubiquitous footprint and unauthenticated network vector, but note that absence of KEV/EPSS/POC means there is no current evidence of active or imminent mass exploitation.

A remote, unauthenticated attacker sends crafted input over the network to a service that reaches the Windows Partition Management Driver, triggering an out-of-bounds read in the kernel driver that is leveraged to corrupt or disclose memory and ultimately execute attacker-controlled code. No public exploit code is referenced, and reliable OOB-read-to-RCE typically requires defeating kernel memory protections, so weaponization is non-trivial despite the Critical rating.